Loading story…
A fraudulent Apple-branded preorder page for a purported iPhone Duo lured visitors with a $500 voucher while attempting to trigger the leaked DarkSword iOS exploit chain as soon as the site opened in Safari. The attack reportedly required no form submission, download, or approval prompt. Captured payload code was designed to gather device details, Apple Notes, installed-app information, Keychain credentials, cryptocurrency-wallet data, photos, communications records, and location-related caches, then contact a command-and-control server.
The apparent targeting overlaps older iOS releases, including versions in the iOS 18.4–18.6.2 range associated with DarkSword. Apple had previously patched DarkSword vulnerabilities reported by Google in March, and updated devices are reported to be protected; however, researchers could not confirm the exact vulnerable version range, did not execute the malware on an iPhone, and did not observe data exfiltration. The payload appears non-persistent after a reboot, though a restart cannot restore data already collected. iVerify characterized DarkSword as the second mass iOS attack disclosed within two weeks.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Google described the DarkSword exploit chain, elements of which later appeared in code captured from the fraudulent preorder page. iVerify estimated at that disclosure that up to 270 million devices were running iOS 18.4 through 18.6.2, though this was not a current exposure estimate.
A fraudulent Apple-themed iPhone Duo preorder page used a $500 voucher lure while attempting to trigger a leaked DarkSword exploit chain when opened in Safari. The captured payload was designed to collect device, credential, wallet, communications, photo, and location-related data and contact pnmrud[.]cc, though researchers did not execute it on an iPhone or observe exfiltration.
Apple patched vulnerabilities reported in connection with the DarkSword attacks. Apple stated that devices updated with its fixes are protected against the reported attacks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourceiverify.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from **Google**, **iVerify**, and **Lookout** disclosed **DarkSword**, a sophisticated iPhone exploit chain used in compromised websites to silently infect visitors, with observed targeting focused on **Ukraine** and additional activity tied to **Saudi Arabia, Turkey, and Malaysia**. The campaign is linked to suspected Russian operators, including activity tracked as **UNC6353**, and appears to support both **espionage** and **financial theft**, including the theft of saved passwords, text messages, and cryptocurrency wallet data. Reporting also indicates DarkSword is the second major iOS exploit kit recently found in the wild after **Coruna**, reinforcing concerns that advanced mobile exploitation is becoming more broadly operationalized rather than reserved for narrowly targeted, bespoke use. Technical analysis shows DarkSword used multiple chained vulnerabilities to achieve full device compromise on older iOS versions, including JavaScriptCore bugs **`CVE-2025-31277`** and **`CVE-2025-43529`** for remote code execution, **`CVE-2026-20700`** as a `dyld` PAC bypass, and sandbox escapes that pivoted from **WebContent** to the **GPU process** and then to `mediaplaybackd`. The exploit chain relied on first compromising **WebKit** and then abusing **WebGPU/ANGLE**-related paths to escape Safari’s sandbox, and Apple patched the flaws across later iOS releases including **18.6**, **18.7.3**, **26.2**, and **26.3**. Researchers warned that a substantial installed base of devices running **iOS 18 or earlier** remained exposed at the time of disclosure, making DarkSword notable both for its technical sophistication and for the scale of potentially vulnerable iPhones.
Sep 4, 2026
Hungary's National Cybersecurity Institute warned that **DarkSword**, a publicly available spyware and exploit kit for Apple devices, is targeting iPhones and iPads running `iOS 18.4` through `18.7` and corresponding `iPadOS` versions. The malware was described as easy to deploy after its code was released on a popular code-sharing platform, lowering the barrier for cyber-espionage activity. Once executed, DarkSword can steal contacts, messages, call history, authentication-related data, and other sensitive information, then exfiltrate it to attacker-controlled servers before deleting itself from the device to hinder detection. New reporting says the operation has since grown into a broad malicious web infrastructure spanning **180 web properties and 27 hosts**, using fake Apple sign-in pages, Apple-themed lures, and compromised websites to deliver a leaked six-vulnerability exploit chain and **GHOSTBLADE** data-theft modules. Researchers said successful compromise can expose keychain contents, iCloud data, Wi-Fi credentials, files, and Apple ID credentials, while operators rotate servers quickly and remove artifacts such as crash reports and `RemoteLog.log` to frustrate forensic analysis. Defenders were urged to apply Apple security updates, enable **Lockdown Mode** where patching is delayed, and monitor for recurring infrastructure fingerprints tied to the campaign.
Aug 4, 2026
Proofpoint and other researchers said the Russia-linked threat group **TA446**—also tracked as **Callisto**, **COLDRIVER**, **SEABORGIUM**, and **Star Blizzard**—used the leaked **DarkSword** iOS exploit kit in a targeted spear-phishing campaign aimed at compromising iPhone users. On March 26, the actor sent spoofed Atlantic Council "discussion invitation" emails from compromised accounts, redirecting selected recipients to DarkSword infrastructure that delivered the **GHOSTBLADE** dataminer, while non-iPhone users were reportedly shown a benign PDF decoy. Researchers said this is the first observed case of TA446 targeting Apple devices and **iCloud**-related access. The campaign was linked to TA446 through infrastructure overlaps, including VirusTotal samples referencing a TA446 second-stage domain and URLScan evidence showing a TA446-controlled domain serving DarkSword components. The operation also appeared broader than the group’s typical espionage activity, with targeting spanning government, think tanks, higher education, financial, and legal organizations. Apple separately warned users running older **iOS** and **iPadOS** versions to update because of active web-based attacks, while researchers cautioned that the leaked GitHub version of DarkSword could reduce the barrier to entry for advanced iPhone exploitation and help turn a nation-state capability into more widely available malware.
Jun 29, 2026